Gate the @claude mention workflow on the operator - #145
Conversation
The repo went public today with this workflow ungated, so any passer-by could spend the operator's subscription by writing "@claude" in a comment. It now checks both actors, the rule every other job here follows — on a re-run github.actor stays whoever started the original run, and the person who pressed re-run appears only in github.triggering_actor. Bots stay refused deliberately: the action rejects bot actors unless listed in allowed_bots, and no bot edge is opened here. Cross-vendor review belongs in a workflow that fires on every PR, not in a mention edge where one bot can spend the operator's quota by talking to another. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@codex review |
Deploying ystack with
|
| Latest commit: |
d4c8b72
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://067ce9d0.fabrica-6yx.pages.dev |
| Branch Preview URL: | https://ystack-fix-claude-mention-ac.fabrica-6yx.pages.dev |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 13dd816990
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| github.actor == 'yihanzhu' && | ||
| github.triggering_actor == 'yihanzhu' && |
There was a problem hiding this comment.
For the issues: assigned trigger, github.actor and github.triggering_actor identify the operator who assigned the issue, not the person who wrote its title or body. An outsider can therefore open an issue containing @claude and attacker-controlled instructions; if the operator later assigns that issue during normal triage, both new checks pass and Claude processes the outsider's text, spending quota despite this gate. Remove the assigned trigger or also require the issue author to be the operator.
Useful? React with 👍 / 👎.
yihanzhu
added
the
needs-human
Codex [Security]: the actor gate says who triggered the event, not who wrote the text the agent then reads. On `issues: assigned` the actor is the operator doing triage while the body belongs to whoever opened the issue — so a stranger could file an issue containing "@claude" and instructions, and it would run the moment it was assigned. Issue events now also require the issue author to be the operator. Comment events need no separate check: there the actor is the author. The general shape, worth carrying: gate on the provenance of the CONTENT an agent will act on, not only on who fired the event. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
@codex review |
yihanzhu
removed
the
needs-human
|
Codex Review: Didn't find any major issues. Bravo. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
The repo went public today with this workflow ungated: anyone could write
@claudein a comment and spend the operator's subscription. It now requires bothgithub.actorandgithub.triggering_actorto be the operator — the same both-actors rule the spec states for every gate, because on a re-run the first field names whoever started the original run.Bots stay refused on purpose. The action already rejects bot actors unless they are in
allowed_bots, and no bot edge is opened here: cross-vendor review belongs in a workflow that fires on every PR (Stack B'sreview-on-pr), not in a mention edge where one bot can spend your quota by talking to another.🤖 Generated with Claude Code